Vulnerability Report: GO-2023-1840
standard library- CVE-2023-29403
- Affects: runtime
- Published: Jun 08, 2023
- Modified: May 20, 2024
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
Affected Packages
-
PathGo VersionsSymbols
-
before go1.19.10, from go1.20.0-0 before go1.20.5all symbols
Aliases
References
- https://go.dev/issue/60272
- https://go.dev/cl/501223
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://vuln.go.dev/ID/GO-2023-1840.json
Credits
- Vincent Dehors from Synacktiv
Feedback
See anything missing or incorrect?
Suggest an edit to this report.